Detect dependency source redirection

CHANGELOG.md

@@ -47,6 +47,7 @@
 * fix(provider): preserve the original custom CLI-provider call contract for ordinary scans
 * build: move LangGraph Studio tooling to the langgraph-dev optional extra (550b9f0)
 * ci: keep eligible pull-request branches current after main changes (#376)
+* Report HIGH SC10 findings when package-manager configuration changes a dependency source trust boundary.
 ---
 ### 2.9.6 (Tuesday, August 18, 2026)
 ### Features/Bug Fixes

README.md

@@ -417,7 +417,7 @@ SkillSpector detects **71 vulnerability patterns** across 17 categories:
 | PE2 | Sudo/Root Execution | MEDIUM | Invoking elevated system privileges |
 | PE3 | Credential Access | HIGH | Reading SSH keys, tokens, passwords |
 
-### Supply Chain (9+ patterns)
+### Supply Chain (10+ patterns)
 
 | ID | Pattern | Severity | Description |
 |----|---------|----------|-------------|
@@ -429,6 +429,7 @@ SkillSpector detects **71 vulnerability patterns** across 17 categories:
 | SC6 | Typosquatting | HIGH | Package names similar to popular packages |
 | SC8 | Shipped Python Bytecode | HIGH | `__pycache__` / `.pyc` present (discovery skips; malicious bytecode bypass) |
 | SC9 | Concealed Executable Artifact | HIGH | Executable nested in a document container or hidden/disguised artifact |
+| SC10 | Dependency Source Redirection | HIGH | Package-manager source added, replaced, or unresolved |
 
 ### Excessive Agency (5 patterns)
 

docs/DEPENDENCY_SOURCE_REDIRECTION.md

@@ -0,0 +1,41 @@
+# Dependency Source Redirection
+
+SkillSpector reports deterministic HIGH SC10 findings when skill content adds or replaces a
+package-manager source, or when the destination cannot be resolved from simple local assignments.
+This makes the dependency trust-boundary change explicit without making a reputation judgment
+about the destination.
+
+## Supported ecosystems and surfaces
+
+| Ecosystem | Direct configuration | Commands and environment | Generated configuration |
+|---|---|---|---|
+| npm | `.npmrc` registry and scoped registry | `npm config set`, `NPM_CONFIG_REGISTRY` | `.npmrc` heredoc |
+| Yarn | `.yarnrc`, `.yarnrc.yml` | `yarn config set` | Yarn config heredoc |
+| pip | `pip.conf`, `pip.ini` | index flags, `pip config set`, `PIP_INDEX_URL`, `PIP_EXTRA_INDEX_URL` | pip config heredoc |
+| Poetry | `pyproject.toml` sources | `poetry source add`, repository config | `pyproject.toml` heredoc |
+| Maven | `settings.xml`, `pom.xml` repositories and mirrors | Maven CLI repository override | Maven XML heredoc |
+| Cargo | `.cargo/config`, `.cargo/config.toml` sources and registries | Cargo registry-index environment variables | Cargo config heredoc |
+
+Commands in executable scripts and shell-language Markdown fences are actionable scan surfaces.
+Explanatory prose, comments, and non-shell fences do not create SC10 findings.
+
+## Evidence
+
+Each finding records the ecosystem, add/replace operation, configuration surface, scope,
+destination, and whether that destination was resolved. Simple literal variables defined in the
+same file are resolved without evaluating shell code. Dynamic destinations are reported as
+`unresolved` rather than ignored.
+
+Credentials and sensitive query values embedded in URLs are redacted from findings and every
+report format. The analyzer never logs credentials, executes configuration, or contacts the
+destination.
+
+## Trust model
+
+Canonical public defaults are built into the analyzer solely to avoid reporting an unchanged
+default as a redirection. Every other resolved destination is reported uniformly: SkillSpector
+does not maintain an organization allowlist, infer whether a host is public or private, perform
+DNS resolution, or make network/reputation calls.
+
+SC10 remains HIGH through optional LLM meta-analysis. An explicit, user-selected baseline retains
+its existing ability to suppress reviewed findings.